pal-e-docs

Review: Hetzner: Request port 25 outbound unblock

review-1732-2026-07-03 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets -- "No code changes" (manual action, acceptable)
  • [x] Feature Flag -- "none" (correct for infra work)
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related

Traceability

  • [x] story:self-hosted label -- "As platform admin, I want zero third-party email dependencies so I control deliverability and avoid Gmail app password rotation"
  • [x] story note verified -- found in project-stalwart-email user-stories section
  • [x] arch:edge-vps label -- references the Hetzner edge VPS component
  • [ ] arch note MISSING -- [SCOPE] Create architecture note arch-edge-vps for component edge-vps
  • [x] Forgejo issue -- ldraney/pal-e-platform#497, open

File Targets

N/A -- issue explicitly states "No code changes -- this is a manual action in Hetzner Cloud Console." Appropriate for a type:infra issue that involves a provider console request.

Repo Placement

OK -- filed on ldraney/pal-e-platform which is the correct home for platform-level infrastructure issues. No multi-repo concerns.

Dependencies

This ticket self-identifies as a blocking dependency: "This is a blocking dependency for all other Stalwart work." Confirmed by board inspection -- items #1733 (Stalwart install, arch:stalwart, 5pts), #1736 (Stalwart config, arch:stalwart, 3pts), and #1740 (validation, arch:stalwart) all depend on port 25 being open. Dependencies are documented in the Context section. No undocumented blockers found.

Acceptance Criteria

3 criteria, all verifiable:
  • "Port 25 unblock request submitted" -- manual verification in Hetzner console
  • "Request approved by Hetzner" -- confirmable via console status or email notification
  • "Verified with: telnet gmail-smtp-in.l.google.com 25 from edge VPS" -- concrete, automatable test command
AC are clear and testable. An agent can verify criterion 3 via SSH.

Blast Radius

Minimal. This is a network-level change (outbound port 25 unblock) on the Hetzner edge VPS. No code changes, no configuration drift risk. The constraint "DO NOT open inbound port 25" is explicitly documented, preventing accidental exposure. No sibling services affected.

Decomposition Assessment

No decomposition needed. Zero file targets, 3 acceptance criteria, single-domain action (Hetzner console). The async wait for Hetzner approval is external and does not increase agent complexity. Well under the 5-minute rule.

Recommendation

  • [SCOPE] Create architecture note arch-edge-vps for the Hetzner edge VPS component. This note should document: the VPS IP (178.156.129.142), its role in the platform (mail server, reverse proxy), managed-by (SaltStack), and services running on it (Stalwart, Caddy).